CVE-2023-6630CWE-359

Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference

Medium · published January 11, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 27.0th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2024-01-11T04:30Z
EPSS history
Timeline
  • 11 JAN 04:30Z
    Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
    cvelistv5